Apparatus, methods, and computer program products for monitoring network activity for child related risks

ABSTRACT

Embodiments of the present invention provide apparatus, method and/or computer program products for monitoring internet activity. In some method embodiments, a network is searched to detect network data indicative of actual and/or potential contact with a child. A report is generated that identifies a source of detected data and the report is sent to a responsible party.

CROSS-REFERENCE TO RELATED PATENT APPLICATION

This application is a continuation application of U.S. patentapplication Ser. No. 11/855,369 filed Sep. 14, 2007 and since issued asU.S. Pat. No. 8,296,843, and incorporated herein by reference in itsentirety.

FIELD OF THE INVENTION

This invention relates to network monitoring apparatus, methods, andcomputer program products and, more particularly, to apparatus, methodsand computer program products for monitoring network activity for childrelated risks.

BACKGROUND OF THE INVENTION

The evolution of networks, such as the internet, cellular, wireless,broadband, and other communication technologies, has led to an explosionin the variety of ways that children can be placed at risk. For example,on-line predators, such as pedophiles and other would-be abusers, oftenuse the internet to gather information from and about children. Accessto this information by unscrupulous people places the children at riskof exploitation and/or abuse. In many circumstances, the childvoluntarily posts personal information that can be used to further thegoal of exploitation. Further, children can be contacted and/orencouraged to contact potential miscreants using cellular telephones orother mobile communication devices. Because child predators frequentlyinstruct the child not to inform their parents, the child may use acellular telephone to make calls to or receive calls from an individualthat that may present a risk to a child.

As the communications networks become more pervasive, the access tothese networks becomes more commonplace, and thus, more available tochildren. In this regard, parents are faced with additional challengesin managing the risks that children are subjected to through and withthe networks. The monitoring task may be complicated in the circumstancewhere a parent lacks the technological sophistication to personallymanage, monitor, and/or limit the network access points.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide apparatus, method and/orcomputer program products for monitoring internet activity. In somemethod embodiments, a network is searched to detect network dataindicative of actual and/or potential contact with a child. A report isgenerated that identifies a source of detected data and the report issent to a responsible party.

Generating the report may include generating a baseline report thatincludes network addresses corresponding to previous postings of thedetected data and/or an update report that includes network addresses ofdata detected following a generation of a previous report. Generatingthe report can include comparing a source of detected data with anapproved list of contacts and generating a report that identifies anunapproved contact that is not included on the approved list ofcontacts.

In some embodiments, searching can comprise monitoring the network atregular time intervals to detect recent network postings of detecteddata. A report of network addresses and dates of recent network postingsof detected data can also be generated. The detected data can include aname, an age, contact information, an identification number, and/or analias. In some embodiments, instructions that are in response to thereport and are configured to reduce network related risk to a child canbe received from the responsible party.

Further embodiments can include monitoring communications of the childto detect data inclusive of private information corresponding to thechild and/or the child's family. Monitoring communications of the childcan be used to determine an identity of a correspondent. The identitycan be compared to a list of approved correspondents to determine if thecorrespondent is approved and an alert report can be generated if thecorrespondent is not approved. The communications can be internet-basedand/or mobile electronic device communications. The report can include acommunications log configured to contain data corresponding tocommunications sent from and received by the device in the case ofmobile electronic device communications. In some embodiments, a reportbased on mobile electronic device communications can be a location logcorresponding to geographic locations of the device during a specifiedtime interval.

In still further embodiments, a recent posting of detected data relatingto a child can be compared to a previous report of detected data and anupdate report can be generated that corresponds to recently detecteddata. Communications of the child can be monitored and a reportcorresponding to the communications can be generated such that thecommunications with a correspondent can be evaluated. The communicationsto be included in the report can be determined by comparing the identityof the correspondent to a list of approved correspondents.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flowchart illustrating operations for monitoring networkactivity according to some embodiments of the present invention.

FIG. 2 is a block diagram illustrating a network activity monitoringapparatus, methods and/or computer program products according to someembodiments of the present invention.

FIG. 3 is a block diagram illustrating report generating apparatus,methods and/or computer program products according to some embodimentsof the present invention.

FIG. 4 is a flow diagram illustrating operations for updating a networkactivity report according to some embodiments of the present invention.

FIG. 5 illustrates a network activity report according to someembodiments of the present invention.

DETAILED DESCRIPTION

The present invention now will be described more fully hereinafter withreference to the accompanying figures, in which embodiments of theinvention are shown. This invention may, however, be embodied in manyalternate forms and should not be construed as limited to theembodiments set forth herein.

Accordingly, while the invention is susceptible to various modificationsand alternative forms, specific embodiments thereof are shown by way ofexample in the drawings and will herein be described in detail. Itshould be understood, however, that there is no intent to limit theinvention to the particular forms disclosed, but on the contrary, theinvention is to cover all modifications, equivalents, and alternativesfalling within the spirit and scope of the invention as defined by theclaims. Like numbers refer to like elements throughout the descriptionof the figures.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the invention. Asused herein, the singular forms “a”, “an” and “the” are intended toinclude the plural forms as well, unless the context clearly indicatesotherwise. It will be further understood that the terms “comprises”,“comprising,” “includes” and/or “including” when used in thisspecification, specify the presence of stated features, integers, steps,operations, elements, and/or components, but do not preclude thepresence or addition of one or more other features, integers, steps,operations, elements, components, and/or groups thereof. Moreover, whenan element is referred to as being “responsive” to another element, itcan be directly responsive to the other element, or intervening elementsmay be present. In contrast, when an element is referred to as being“directly responsive” to another element, there are no interveningelements present. As used herein the term “and/or” includes any and allcombinations of one or more of the associated listed items and may beabbreviated as “/”.

It will be understood that, although the terms first, second, etc. maybe used herein to describe various elements, these elements should notbe limited by these terms. These terms are only used to distinguish oneelement from another.

The present invention is described below with reference to blockdiagrams and/or flowchart illustrations of methods, apparatus (systemsand/or devices) and/or computer program products according toembodiments of the invention. It is understood that a block of the blockdiagrams and/or flowchart illustrations, and combinations of blocks inthe block diagrams and/or flowchart illustrations, can be implemented bycomputer program instructions. These computer program instructions maybe provided to a processor of a general purpose computer, specialpurpose computer, and/or other programmable data processing apparatus toproduce a machine, such that the instructions, which execute via theprocessor of the computer and/or other programmable data processingapparatus, create means (functionality) and/or structure forimplementing the functions/acts specified in the block diagrams and/orflowchart block or blocks.

These computer program instructions may also be stored in acomputer-readable memory that can direct a computer or otherprogrammable data processing apparatus to function in a particularmanner, such that the instructions stored in the computer-readablememory produce an article of manufacture including instructions whichimplement the function/act specified in the block diagrams and/orflowchart block or blocks.

The computer program instructions may also be loaded onto a computer orother programmable data processing apparatus to cause a series ofoperational steps to be performed on the computer or other programmableapparatus to produce a computer-implemented process such that theinstructions which execute on the computer or other programmableapparatus provide steps for implementing the functions/acts specified inthe block diagrams and/or flowchart block or blocks.

Accordingly, the present invention may be embodied in hardware and/or insoftware (including firmware, resident software, micro-code, etc.).Furthermore, the present invention may take the form of a computerprogram product on a computer-usable or computer-readable storage mediumhaving computer-usable or computer-readable program code embodied in themedium for use by or in connection with an instruction execution system.In the context of this document, a computer-usable or computer-readablemedium may be any medium that can contain, store, communicate,propagate, or transport the program for use by or in connection with theinstruction execution system, apparatus, or device.

The computer-usable or computer-readable medium may be, for example butnot limited to, an electronic, magnetic, optical, electromagnetic,infrared, or semiconductor system, apparatus, device, or propagationmedium. More specific examples (a non-exhaustive list) of thecomputer-readable medium would include the following: an electricalconnection having one or more wires, a portable computer diskette, arandom access memory (RAM), a read-only memory (ROM), an erasableprogrammable read-only memory (EPROM or Flash memory), an optical fiber,and a portable compact disc read-only memory (CD-ROM). Note that thecomputer-usable or computer-readable medium could even be paper oranother suitable medium upon which the program is printed, as theprogram can be electronically captured, via, for instance, opticalscanning of the paper or other medium, then compiled, interpreted, orotherwise processed in a suitable manner, if necessary, and then storedin a computer memory.

It should also be noted that in some alternate implementations, thefunctions/acts noted in the blocks may occur out of the order noted inthe flowcharts. For example, two blocks shown in succession may in factbe executed substantially concurrently or the blocks may sometimes beexecuted in the reverse order, depending upon the functionality/actsinvolved. Moreover, the functionality of a given block of the flowchartsand/or block diagrams may be separated into multiple blocks and/or thefunctionality of two or more blocks of the flowcharts and/or blockdiagrams may be at least partially integrated.

Some embodiments of the present invention may arise from recognitionthat it may be desirable to monitor network activity for information orcontent that may pose a risk to children. In particular, personal datarelating to a child or contact information regarding persons contactingand/or contacted by the child may be of particular interest to aresponsible party such as a parent or guardian. In embodiments of thepresent invention, responsive to detection of network activity relatingto a child, a report is generated and sent to a responsible party. Asused herein, a “network device” may comprise any device or group ofdevices configured to send, receive, process, and/or store data that canbe accessed by more than one person. Examples of network devicesinclude, but are not limited to, computers, telephones, and mobileelectronic devices, such as cellular telephones and PDA's, among others.

FIG. 1 illustrates operations for monitoring network activity accordingto some embodiments of the present invention. The operations begin withsearching a network to detect data indicative of actual and/or potentialcontact with a child (block 110). A network can be, for example, acellular telephone network and/or the internet. For example, the networkcan include websites and web-based communities such as Myspace.com,blogs, and/or text messaging services and/or devices such as InstantMessaging (IM) and Short Message Service (SMS) capable devices. In someembodiments, the detected data can include a child's personal data,contact information, identification numbers and/or information regardingfamily and/or friends.

A report is generated that identifies a source of the detected data(block 120). The report can include network addresses or identifierscorresponding to postings or other occurrences of detected data. Thereport can also include data corresponding to communications made by orto the child. Additionally, the report can include data relating togeographical locations that the child has frequented including dates andtimes of the visits.

The report is then sent to a responsible party (block 130), such as, forexample, a parent, guardian, and/or caretaker. By receiving a report ofdata that is detected in a network search, a parent, for example, candetermine and possibly reduce the risks to a child based on the networkactivity or information. For example, a parent receiving a report thatincludes the network address, telephone number, and/or identity of apotential online predator may be able to curtail or prevent futurecontact between the child and the potential predator, thus reducing therisk to the child. Similarly, by receiving a report that includeslocation information that a parent was previously unaware of, the parentcan determine if a child has been frequenting unsafe and/or otherwiseoff-limits locations.

FIG. 2 illustrates an apparatus, method and/or computer program productand the operations thereof for monitoring network activity according tosome embodiments of the present invention. A network is searched (block210) to detect network data that is indicative of actual and/orpotential contact with a child. Data detected by the search can includeinternet postings of related to the child, such as name, address,telephone number, alias or nickname, age, and/or identification numbers.Examples of identification numbers can include social security number,student identification number, credit card number, and online accountnumbers, among others. Other information relating to the child can alsobe detected, such as that relating to family and/or friends.Additionally, communications by or with a child, such as cellulartelephone, email, instant messaging, web logs, can be monitored todetect data that is inclusive of private information corresponding tothe child and/or other indications of potential risk.

A report is generated (block 220) that identifies a source of networkdata detected in the search. The source of network data can be, forexample, a network address of an internet posting that is indicative ofcontact or potential contact with the child. The source of network datacan also be an email address, a web log identifier, and/or an instantmessaging address, alias, or identifier. The report can also, in thecase of cellular communications, be a call log that can includetelephone numbers that called the child or were called by the child.Further, the report can be a location log that can include geographicallocation information generated by a mobile electronic device that isequipped with, for example, a positioning system receiver, such as aGlobal Positioning System (GPS) receiver.

The report is transmitted (block 230) to a responsible party, such as aparent or guardian of the child. The report can be transmitted using avariety of media including, but not limited to, paper, magnetic,optical, or electronic storage media. Additionally, the report can betransmitted electronically using wired and/or wireless communicationtechniques. Based on the content of the report, instructions can bereceived (block 240) from the responsible party. The instructions can beconfigured to reduce network related risks to a child and can include,for example, requests to control a child's access to specific networkaddresses or contacts. For example, a contact can be added to a “buddy”list of approved contacts. Also, the instructions can include requestsfor additional information or scrutiny regarding the reportedinformation. For example, a new contact can be blocked and furtherinvestigated before the child is permitted to further communicate withthe contact. In the case where the report includes geographicalinformation, the instructions may request an alert notification anytimethe child returns to a particular location. The report can also requestnotification if a child leaves a particular location during a specifiedtime. For example, a parent may want notification if the child leavesschool during the time the child is scheduled to be in school.

FIG. 3 illustrates an apparatus, method and/or computer program productand the operations thereof for generating a report according to someembodiments of the present invention. Networks can be monitored (block250) at predetermined intervals to provide current data regardingnetwork activity that is indicative of actual and/or potential contactwith a child. The results from the regular monitoring can be compared(block 260) to previously detected data. The comparison can beconfigured to determine new contacts or communications since the mostrecent network search was performed. The comparison can also beconfigured to compare contacts, network addresses, phone number, and/orgeographical locations to a list of those previously approved and/ordisapproved. Based on the comparison, the report can be updated (block270) to include current, new, and/or previously unapproved detecteddata. For example, a baseline report can be generated the first time anetwork is searched and an update report can be generated for eachsubsequent search of the network. The update report can be configured toinclude detected data that has occurred since the baseline or a morerecent update report was generated.

FIG. 4 is a flow diagram illustrating operations for updating a networkactivity report according to some embodiments of the present invention.A network is searched (block 310) and data indicative of potentialand/or actual contact with a child is detected (block 320). The detecteddata is compared to an approved list (block 330) to determine if thecontact and/or correspondent is on the approved list (block 340). If thecontact is not on the approved list, then a new contact report isgenerated (block 350) and the report is sent (block 360) to aresponsible party. If the contact is on the approved list, then a reportregarding that contact is not generated. In this manner, the responsibleparty receives reports in the circumstance where the child has contactwith persons not already evaluated for risk to the child.

FIG. 5 illustrates a network activity report 400 according to someembodiments of the present invention. The report can include, forexample, a source of detected data (block 410), data (block 420) and adate and/or time of data posting (block 430). The source of selecteddata 410 can include data relating to communications with and/or by thechild, such as on the internet and/or through a mobile electronicdevice. The source of selected data 410 can also include network postingthat is made by a third party, such as a friend, family member, and/oronline predator.

The data 420 can be personal data, such as name, age, contactinformation, identification number, alias, and/or information regardingfriends and/or family. The data 420 can also include a call log that caninclude, for example, a telephone number and/or duration of call.Similarly, the data 420 can also include a location log that includes alist of geographical locations where, for example, a child spends morethan a specified amount of time. The location log may also include alisting of times when a child visits a place that is designatedoff-limits by the parent or other responsible party. The data 420 canfurther include a network address that corresponds to the location of aspecific posting and/or a point of origination for a posting. The dateand/or time that data 420 is posted and/or a communication is made canbe included and can be useful to determine whether detected data hasalready been scrutinized and/or investigated. A network activity report400 under the invention disclosed herein can include any combination ofthe contents described above and can be used by a parent or otherresponsible party to reduce potential risks to a child associated withinformation on one or more networks.

What is claimed is:
 1. A method, comprising: detecting, by a computer,Internet postings associated with a network address and a child's age inyears; retrieving, by the computer, an electronic communications logassociated with the network address, the electronic communications loglogging electronic communications previously sent and received, theelectronic communications all associated with the network address andwith different correspondent addresses; retrieving, by the computer, anelectronic locations log associated with the network address, theelectronic locations log logging times at geographical locationsassociated with the network address; generating, by the computer, anelectronic report that identifies the different correspondent addresseslogged in the electronic communications log and a list of thegeographical locations logged in the electronic locations log thatexceed a specified amount of time; retrieving, by the computer, aparental network address associated with a parent of the child; sending,by the computer, the electronic report to the parental network address;and receiving, by the computer, in response to the electronic report,instructions comprising a location and a notification request, thenotification request requesting an electronic notification be sent tothe parental network address in response to a current locationassociated with the network address differing from the location.
 2. Themethod of claim 1, wherein the electronic report comprises a baselinereport that includes the different correspondent addresses and anupdated report that includes the correspondent addresses logged afterthe baseline report.
 3. The method of claim 1, further comprising:comparing the different correspondent addresses logged in the electroniccommunications log to entries in an approved list of contacts; andreporting an unapproved contact not included in the approved list ofcontacts.
 4. The method of claim 1, further comprising monitoring theelectronic communications log at regular time intervals.
 5. The methodof claim 1, further comprising retrieving a name and contact informationassociated with the parental network address.
 6. The method of claim 1,further comprising monitoring network communications associated with thenetwork address.
 7. The method of claim 1, further comprising loggingshort message service (SMS) messages in the electronic communicationslog.
 8. The method of claim 1, further comprising logging calls in theelectronic communications log.
 9. The method of claim 1, furthercomprising logging website addresses in the electronic communicationslog.
 10. The method of claim 1, further comprising logging theelectronic communications in the electronic communications log.
 11. Themethod of claim 1, further comprising searching the electroniccommunications log for a credit card number associated with the networkaddress.
 12. A system, comprising: a processor; and a memory device, thememory device storing instructions, the instructions when executedcausing the processor to perform operations comprising: detectingInternet postings associated with a network address and a child's age inyears; retrieving an electronic communications log associated with thenetwork address, the electronic communications log logging electroniccommunications previously sent and received and associated with thenetwork address and with correspondent addresses; retrieving anelectronic locations log associated with the network address, theelectronic locations log logging times at geographical locationsassociated with the network address; generating an electronic reportthat identifies the correspondent addresses logged in the electroniccommunications log and a list of the geographical locations logged inthe electronic locations log that exceed a specified amount of time;retrieving a parental network address associated with a parent of thechild; sending the electronic report to the parental network address;and receiving, in response to the electronic report, instructionsspecifying comprising a location and a notification request, thenotification request requesting an electronic notification be sent tothe parental network address in response to a current locationassociated with the network address differing from leaving the locationspecified by the instructions.
 13. The system of claim 12, wherein theoperations further comprise logging short message service (SMS) messagesin the electronic communications log.
 14. The system of claim 12,wherein the operations further comprise logging calls in the electroniccommunications log.
 15. The system of claim 12, wherein the operationsfurther comprise logging website addresses in the electroniccommunications log.
 16. The system of claim 12, wherein the operationsfurther comprise logging the electronic communications in the electroniccommunications log.
 17. A memory device storing instructions that whenexecuted cause a processor to perform operations, the operationscomprising: detecting Internet postings associated with a networkaddress and a child's age in years; retrieving an electroniccommunications log associated with the network address, the electroniccommunications log logging electronic communications previously sent andreceived by a device associated with the network address, the electroniccommunications log also logging correspondent addresses; retrieving anelectronic locations log associated with the network address, theelectronic locations log logging times at geographical locationsassociated with the network address; generating an electronic reportthat identifies the correspondent addresses logged in the electroniccommunications log and a list of the geographical locations logged inthe electronic locations log that exceed a specified amount of time;retrieving a parental network address associated with a parent of thechild; sending the electronic report to the parental network address;and receiving, in response to the electronic report, instructionscomprising a location and a notification request, the notificationrequest requesting that an electronic notification be sent to theparental network address in response to a current location associatedwith the network address differing from the location.
 18. The memorydevice of claim 17, wherein the operations further comprise loggingshort message service (SMS) messages in the electronic communicationslog.
 19. The memory device of claim 17, wherein the operations furthercomprise logging calls in the electronic communications log.